ework-web 0.10.15 → 0.10.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.15",
+  "version": "0.10.17",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/config.ts

@@ -107,7 +107,7 @@ export const SETTINGS_GROUPS: SettingGroup[] = [
   {
     title: "AI 模型",
     fields: [
-      { key: "defaultModel", label: "默认模型（空 = 用 opencode.json；注意环境变量可能污染，建议点下方刷新自动选一个）", type: "model" },
+      { key: "defaultModel", label: "默认模型（点下方「刷新 opencode 模型列表」更新）", type: "model" },
     ],
   },
   {

package/src/db-admin.ts

@@ -575,6 +575,75 @@ const DAEMON_DDL: Record<string, string> = {
     ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4",
 };
 
+export interface DdlResult {
+  ok: true;
+  sql: string;
+  database: string;
+  webPrefix: string;
+  daemonPrefix: string;
+}
+
+/** Generate a runnable MySQL script for accounts whose DB user lacks CREATE
+ *  (the wizard's auto-CREATE-DATABASE path is blocked). Reuses migrate()'s
+ *  exact DDL so manual + auto paths stay in sync. Idempotent. */
+export function generateMysqlDDL(
+  opts: MysqlTargetOpts,
+  daemonPrefixRaw: string,
+): DdlResult {
+  const webPrefix = validatePrefix(opts.prefix ?? "");
+  const daemonPrefix = validatePrefix(daemonPrefixRaw);
+  const lines: string[] = [];
+
+  lines.push(`-- ework-web + ework-daemon MySQL schema`);
+  lines.push(`-- Generated for restricted-privilege accounts (no CREATE).`);
+  lines.push(`-- Database: ${opts.database} | web prefix: "${webPrefix}" | daemon prefix: "${daemonPrefix}"`);
+  lines.push(`-- Idempotent — safe to re-run.`);
+  lines.push(``);
+  lines.push(`CREATE DATABASE IF NOT EXISTS ${ident(opts.database)} CHARACTER SET utf8mb4;`);
+  lines.push(`USE ${ident(opts.database)};`);
+  lines.push(``);
+  lines.push(`-- ─── ework-web tables (${webPrefix ? `prefix "${webPrefix}"` : "no prefix"}) ───`);
+
+  for (const stmt of readSchemaMysqlStatements(webPrefix)) {
+    lines.push(stmt + ";");
+  }
+
+  // config table — created in db.ts:SqliteDriver.create at boot, missing from
+  // schema-mysql.sql. Same shape as migrateSqliteToMysql L257-266. `key` is a
+  // MySQL reserved word → backticked.
+  lines.push(
+    applyTargetPrefix(
+      "CREATE TABLE IF NOT EXISTS {{config}} (" +
+        "`key` VARCHAR(255) PRIMARY KEY," +
+        "value TEXT NOT NULL," +
+        "updated_at VARCHAR(40) NOT NULL" +
+        ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;",
+      webPrefix
+    )
+  );
+
+  lines.push(``);
+  lines.push(`-- ─── ework-daemon tables (${daemonPrefix ? `prefix "${daemonPrefix}"` : "no prefix"}) ───`);
+  lines.push(`-- Daemon columns match its SQLite schema; coordination columns`);
+  lines.push(`-- (owner_daemon_id etc.) are added by the daemon's ALTER TABLE on boot.`);
+  for (const table of DAEMON_TABLES) {
+    const ddl = applyTargetPrefix(
+      DAEMON_DDL[table]!.replace(/{{t}}/g, `{{${table}}}`),
+      daemonPrefix
+    );
+    lines.push(ddl + ";");
+  }
+
+  lines.push(``);
+  return {
+    ok: true,
+    sql: lines.join("\n"),
+    database: opts.database,
+    webPrefix,
+    daemonPrefix,
+  };
+}
+
 export async function migrateDaemonSqliteToMysql(
   sqlitePath: string,
   opts: MysqlTargetOpts,

package/src/index.ts

@@ -7,7 +7,7 @@ import { loadConfig, DB_OVERRIDABLE, parseOverride, resolveTtsBackend } from "./
 import type { Config } from "./config";
 import { setConfig, initDB, getDB } from "./db";
 import { getActiveDaemons, listAllDaemons } from "./coordination";
-import { testMysqlConnection, migrateSqliteToMysql, writeMysqlEnv, migrateMysqlToSqlite, writeSqliteEnv, migrateDaemonSqliteToMysql } from "./db-admin";
+import { testMysqlConnection, migrateSqliteToMysql, writeMysqlEnv, migrateMysqlToSqlite, writeSqliteEnv, migrateDaemonSqliteToMysql, generateMysqlDDL } from "./db-admin";
 import type { MysqlTargetOpts } from "./db-admin";
 import { checkAuth, makeAuthCookieHeader, clearAuthCookieHeader, loginHTML, sanitizeNext, ensureBootstrapAdmin, ensureBootstrapSystem, isReservedSystemLogin } from "./auth";
 import { OpencodeError, createOpencodeClient, MultiDaemonOpencodeClient, RemoteOpencodeClient, isLocalhost, type OpencodeClientInterface } from "./opencode";
@@ -201,7 +201,9 @@ function html(body: string, status = 200): Response {
 // The prefix regex below must match db.ts:WORK_DB_PREFIX exactly — if the API
 // accepts a prefix that boot rejects, the wizard writes a .env that restarts
 // into a crash. Any change here must be mirrored in db.ts + db-admin.ts.
-function parseDbTargetOpts(payload: unknown): MysqlTargetOpts | { error: string } {
+type ParsedDbTarget = MysqlTargetOpts & { daemonPrefix?: string };
+
+function parseDbTargetOpts(payload: unknown): ParsedDbTarget | { error: string } {
   if (typeof payload !== "object" || payload === null) return { error: "invalid body" };
   const p = payload as Record<string, unknown>;
   const host = typeof p.host === "string" ? p.host.trim() : "";
@@ -210,17 +212,23 @@ function parseDbTargetOpts(payload: unknown): MysqlTargetOpts | { error: string
   const password = typeof p.password === "string" ? p.password : "";
   const database = typeof p.database === "string" ? p.database.trim() : "";
   const prefix = typeof p.prefix === "string" ? p.prefix.trim() : "";
+  const daemonPrefix = typeof p.daemonPrefix === "string" ? p.daemonPrefix.trim() : "";
   if (!host) return { error: "host required" };
   if (!user) return { error: "user required" };
   if (!database) return { error: "database required" };
   if (!Number.isInteger(portNum) || portNum < 1 || portNum > 65535) {
     return { error: "port must be an integer 1-65535" };
   }
-  if (prefix && !/^[A-Za-z_][A-Za-z0-9_]{0,31}$/.test(prefix)) {
+  const prefixRe = /^[A-Za-z_][A-Za-z0-9_]{0,31}$/;
+  if (prefix && !prefixRe.test(prefix)) {
     return { error: "prefix must match ^[A-Za-z_][A-Za-z0-9_]{0,31}$" };
   }
-  const opts: MysqlTargetOpts = { host, port: portNum, user, password, database };
+  if (daemonPrefix && !prefixRe.test(daemonPrefix)) {
+    return { error: "daemonPrefix must match ^[A-Za-z_][A-Za-z0-9_]{0,31}$" };
+  }
+  const opts: ParsedDbTarget = { host, port: portNum, user, password, database };
   if (prefix) opts.prefix = prefix;
+  if (daemonPrefix) opts.daemonPrefix = daemonPrefix;
   return opts;
 }
 
@@ -805,7 +813,9 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     const rawPayload = await req.json().catch(() => ({}));
     const parsed = parseDbTargetOpts(rawPayload);
     if ("error" in parsed) return json(parsed, 400);
-    const daemonOpts: MysqlTargetOpts = { ...parsed, prefix: daemonPrefix(parsed.prefix ?? "") };
+    const { daemonPrefix: _dp, ...mysqlFields } = parsed;
+    const dPrefix = parsed.daemonPrefix ?? daemonPrefix(parsed.prefix ?? "");
+    const daemonOpts: MysqlTargetOpts = { ...mysqlFields, prefix: dPrefix };
     const envPath = daemonEnvPath();
     if (!envPath) {
       return json({ ok: false, configured: false, manual: daemonManualInstructions(daemonOpts) });
@@ -825,6 +835,21 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     }
   }
 
+  if (req.method === "POST" && url.pathname === "/api/db/ddl") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    if (!rateLimit(`db-ddl:${ip}`, 10, 10 / 60)) return json({ error: "rate limited" }, 429);
+    const payload = await req.json().catch(() => ({}));
+    const parsed = parseDbTargetOpts(payload);
+    if ("error" in parsed) return json(parsed, 400);
+    const dPrefix = parsed.daemonPrefix ?? daemonPrefix(parsed.prefix ?? "");
+    try {
+      const result = generateMysqlDDL(parsed, dPrefix);
+      return json(result);
+    } catch (e) {
+      return json({ ok: false, error: errMsg(e) }, 400);
+    }
+  }
+
   if (req.method === "POST" && url.pathname === "/api/db/revert") {
     if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
     if (!rateLimit(`db-revert:${ip}`, 2, 2 / 3600)) return json({ error: "rate limited" }, 429);

package/src/static/db-wizard.js

@@ -12,7 +12,8 @@
       user: get('db-user').trim(),
       password: get('db-password'),
       database: get('db-database').trim(),
-      prefix: get('db-prefix').trim()
+      prefix: get('db-prefix').trim(),
+      daemonPrefix: get('db-daemon-prefix').trim()
     });
   }
   function setBtns(d) {
@@ -74,6 +75,58 @@
   document.getElementById('db-daemon').onclick = function () { act('daemon-config'); };
   document.getElementById('db-enable').onclick = function () { act('enable'); };
 
+  var ddlBtn = document.getElementById('db-ddl');
+  if (ddlBtn) {
+    ddlBtn.onclick = async function () {
+      setBtns(true);
+      R.className = 'db-result db-loading';
+      R.textContent = '生成建表 SQL…';
+      try {
+        var res = await fetch('/api/db/ddl', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: gather()
+        });
+        var data = await res.json();
+        if (data.ok) {
+          R.className = 'db-result db-ok';
+          R.textContent = '✓ SQL 已生成（' + data.database + ' · web 前缀 "' + (data.webPrefix || '(无)') + '" · daemon 前缀 "' + (data.daemonPrefix || '(无)') + '"）。复制下方 SQL，用有 CREATE 权限的账号在 MySQL 里跑一遍，再回来点 ② 迁移。';
+          var out = document.getElementById('db-ddl-out');
+          var ta = document.getElementById('db-ddl-text');
+          var meta = document.getElementById('db-ddl-meta');
+          ta.value = data.sql;
+          meta.textContent = data.sql.length + ' 字符';
+          out.style.display = '';
+        } else {
+          R.className = 'db-result db-err';
+          R.textContent = '✗ ' + (data.error || '未知错误');
+        }
+      } catch (e) {
+        R.className = 'db-result db-err';
+        R.textContent = '✗ ' + (e.message || String(e));
+      } finally {
+        setBtns(false);
+      }
+    };
+  }
+
+  var ddlCopy = document.getElementById('db-ddl-copy');
+  if (ddlCopy) {
+    ddlCopy.onclick = async function () {
+      var ta = document.getElementById('db-ddl-text');
+      try {
+        await navigator.clipboard.writeText(ta.value);
+        ddlCopy.textContent = '✓ 已复制';
+        setTimeout(function () { ddlCopy.textContent = '📋 复制 SQL'; }, 1500);
+      } catch (e) {
+        ta.select();
+        document.execCommand('copy');
+        ddlCopy.textContent = '✓ 已复制';
+        setTimeout(function () { ddlCopy.textContent = '📋 复制 SQL'; }, 1500);
+      }
+    };
+  }
+
   var revertBtn = document.getElementById('db-revert');
   if (revertBtn) {
     revertBtn.onclick = async function () {

package/src/views/settings.ts

@@ -20,14 +20,15 @@ function fieldInput(group: SettingGroup, cfg: Config, models: CachedModel[]): st
         // If the cache is empty (opencode not yet polled), fall back to a free
         // text input so the user can still type a known provider/model id.
         if (models.length === 0) {
-          return `<label class="sf"><span>${escapeHtml(f.label)}</span><input type="text" name="${escapeAttr(String(f.key))}" value="${escapeAttr(cur)}" placeholder="provider/model（点下面的刷新拉列表）"></label>`;
+          return `<label class="sf"><span>${escapeHtml(f.label)}</span><input type="text" name="${escapeAttr(String(f.key))}" value="${escapeAttr(cur)}" placeholder="provider/model（点下方刷新拉列表）"></label>`;
         }
-        const opts = [`<option value=""${cur === "" ? " selected" : ""}>（用 opencode 默认）</option>`]
-          .concat(
-            models.map(
-              (m) =>
-                `<option value="${escapeAttr(m.id)}"${m.id === cur ? " selected" : ""}>${escapeHtml(m.label)}</option>`
-            )
+        // No empty "use opencode default" option: empty default lets env
+        // vars pollute the model slot (see M-1 in index.ts refresh handler).
+        // If cur is empty, the browser auto-selects the first option.
+        const opts = models
+          .map(
+            (m) =>
+              `<option value="${escapeAttr(m.id)}"${m.id === cur ? " selected" : ""}>${escapeHtml(m.label)}</option>`
           )
           .join("");
         return `<label class="sf"><span>${escapeHtml(f.label)}</span><select name="${escapeAttr(String(f.key))}">${opts}</select></label>`;
@@ -48,20 +49,23 @@ function buildDbSection(viewer: UserRow): string {
   return `<section class="sg db-section">
 <h2>数据库后端</h2>
 <p class="db-badge">当前后端: <strong>${escapeHtml(driver.toUpperCase())}</strong> · ${escapeHtml(currentTarget)}</p>
-<div class="db-warn">⚠ 切换到 MySQL 后 Web 进程会重启并以 MySQL 为存储。若 MySQL 不可达，进程无法启动——需手动编辑 <code>.env</code> 将 <code>WORK_DB_DRIVER</code> 改回 <code>sqlite</code> 才能恢复。流程：先 ① 测试连接、再 ② 迁移数据、最后 ③ 启用。</div>
+<div class="db-warn">⚠ 切换到 MySQL 后 Web 进程会重启并以 MySQL 为存储。若 MySQL 不可达，进程无法启动——需手动编辑 <code>.env</code> 将 <code>WORK_DB_DRIVER</code> 改回 <code>sqlite</code> 才能恢复。流程：先 ① 测试连接、再 ② 迁移数据、最后 ③ 启用。若你的 MySQL 账号无 CREATE 权限，先点 ⑤ 生成建表 SQL，用有权限的账号跑一遍，再回来 ② 迁移。</div>
 <label class="sf"><span>MySQL 主机</span><input type="text" id="db-host" placeholder="127.0.0.1" autocomplete="off"></label>
 <label class="sf"><span>端口</span><input type="number" id="db-port" value="3306" min="1" max="65535" autocomplete="off"></label>
 <label class="sf"><span>用户名</span><input type="text" id="db-user" placeholder="ework" autocomplete="off"></label>
 <label class="sf"><span>密码</span><input type="password" id="db-password" placeholder="••••••" autocomplete="new-password"></label>
 <label class="sf"><span>数据库名</span><input type="text" id="db-database" placeholder="ework" autocomplete="off"></label>
 <label class="sf"><span>表前缀（可选）</span><input type="text" id="db-prefix" placeholder="留空 = 无前缀" autocomplete="off"></label>
+<label class="sf"><span>daemon 前缀（可选）</span><input type="text" id="db-daemon-prefix" placeholder="留空 = 自动用「表前缀」+d_" autocomplete="off"></label>
 <div class="db-controls">
 <button type="button" id="db-test">① 测试连接</button>
 <button type="button" id="db-migrate" class="secondary">② 迁移数据</button>
 <button type="button" id="db-daemon" class="secondary">③ 配置 daemon</button>
 <button type="button" id="db-enable" class="secondary">④ 启用并重启</button>
+<button type="button" id="db-ddl" class="secondary">⑤ 生成建表 SQL（手动建库）</button>
 </div>
 <div id="db-result" class="db-result"></div>
+<div id="db-ddl-out" style="display:none;margin-top:.6rem"><div class="db-controls" style="align-items:center"><button type="button" id="db-ddl-copy" class="secondary">📋 复制 SQL</button><span id="db-ddl-meta" style="font-size:12px;color:var(--text-muted)"></span></div><textarea id="db-ddl-text" readonly style="width:100%;min-height:240px;padding:.5rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font-size:11px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" wrap="off"></textarea></div>
 ${isMysql ? `<hr style="border:0;border-top:1px solid var(--border);margin:1rem 0"><div class="db-controls"><button type="button" id="db-revert" class="secondary">⚠ 切回 SQLite（安全网）</button></div><div id="db-revert-result" class="db-result"></div>` : ""}
 <script src="/static/db-wizard.js"></script>
 </section>`;
@@ -104,7 +108,7 @@ export function buildSettingsPage(cfg: Config, saved: boolean, viewer: UserRow,
   const ttsLink = viewer.is_admin === 1
     ? `<p class="hint">要增删朗读后端（kokoro / cosyvoice3 等），去 <a href="/admin/tts-backends">朗读后端管理</a>。</p>`
     : "";
-  const modelRefreshForm = `<form method="POST" action="/settings/models/refresh" style="margin-top:.4rem"><button type="submit" class="secondary">🔄 刷新 opencode 模型列表</button></form>`;
+  const modelRefreshForm = `<section class="sg"><h2>opencode 模型列表</h2><p class="hint" style="margin:0 0 .6rem">从 <code>opencode models</code> 拉取可用模型并刷新上方下拉列表。刷新后自动选定一个具体模型作为默认（不会留空）。</p><form method="POST" action="/settings/models/refresh"><button type="submit" class="secondary">🔄 刷新 opencode 模型列表</button></form></section>`;
   const html = `<!doctype html>
 <html lang="zh"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -164,9 +168,9 @@ button.secondary{background:transparent;color:var(--text-muted);border:1px solid
 <p class="hint">改完保存立即生效，无需重启。密钥/启动项（token、端口等）仍在 <code>.env</code>，不在此处。</p>
 ${banner}
 <form method="POST" action="/settings">${groups}
-${modelRefreshForm}
 <div class="bar"><button type="submit">保存</button><a class="a-back" href="/">返回</a></div>
 </form>
+${modelRefreshForm}
 ${ttsLink}
 ${buildDbSection(viewer)}
 ${buildDaemonSection(viewer)}